informed-decision/docs/specs/LifecycleAdmissionBoundary.md

Lifecycle admission and evidence boundary

2026-10-05; INFD-WP-0007-T02. This closes the implementation choices for the initial production audience. Expansion is tracked separately; these limits are observable behavior, not an implied grant to extend another owner's interface.

Concern	Implemented contract
Human identity	KeyCape-authenticated net-kingdom-admins, tenant:platform; twelve-hour MFA authoring/list window, fifteen-minute review/read/act window
Agent identity	Kubernetes TokenReview for the registered State Hub service account with a separate lifecycle audience; unknown and external bearer identities refused
Publication	Explicit subject/group audience on an exact revision, authorized by Access Engine; not anonymous or indexed publicly; successor revisions require republication
Research	Caller retrieves evidence externally and submits reference, retrieval time, digest and summary; the service does not fetch URLs or attest their truth
Evaluation	Attributed assessment, uncertainty and source-event references constrained to the same record/revision/tenant
Retention	Append-only revisions, sources, comments, evaluations and binding evidence in the durable store; no automatic purge, mutable source replacement or source connector credentials
Documents	Digest-verified bytes supplied through the bounded API; the browser adds short text documents with optional required acknowledgments as new revisions
Review	Organizational English approval profile using the existing shared schema and native Approval Engine; recipient from the configured review group, initially platform-root
Discovery	Lifecycle workspace uses per-record lifecycle policy. Review overview uses its own list decision; attribute discovery requires the immutable named recipient plus verified native requester, human-control flag and digest
Human acceptance	Existing protected review surface, fresh policy/read/act decisions, exact revision/presentation and required acknowledgments; no agent binding route
Non-approval profiles	Discussion drafts may be authored and refined, but cannot create an approval review. L0/L2 core schema compatibility does not enable new production disposition profiles
Hub write-back	Notification/dispatcher delivery is admitted; optional automatic resolution write-back remains disabled and cannot imply permission to execute

Identity verification stays in KeyCape/TokenReview; authorization stays in Access Engine. The headless application service is shared by browser and private API. Client-supplied research descriptions and evaluation conclusions remain claims with attribution, not machine-verified facts. Packet bytes are retained so an external URL changing cannot alter a past presentation.

No finite retention duration, deletion mechanism, new connector, external agent identity or non-approval signing semantics is invented here. Those product extensions require their own owner contracts and delivery evidence under INFD-WP-0008. The existing source/evaluation and organizational approval workflows provide all nine initial lifecycle operations without per-decision infrastructure changes.